Date: Tue, 27 Feb 2018 11:30:38 -0800 (PST) From: Roger Marquis <marquis@roble.com> To: freebsd-security@freebsd.org Cc: freebsd-ports@freebsd.org Subject: Re: Fwd: [tor-relays] FreeBSD 11.1 ZFS Tor Image Message-ID: <nycvar.OFS.7.76.1802271107210.20686@mx.roble.com> In-Reply-To: <CAD2Ti2_0JFA9h%2BofxkhQsBWd8m9kipKmMNWko4J9ntnS=d-oRA@mail.gmail.com> References: <1778362.rEQJjLh0zu@beastie> <735f5c0a-f6a3-adb4-c615-7e0ce8fb6dea@queair.net> <20180225215044.vzuablpgcweaxwlh@mutt-hbsd> <2537598.fuWUYQZvu7@beastie> <20180225221733.o6jrgeo2d5mfdegg@mutt-hbsd> <CAD2Ti2_0JFA9h%2BofxkhQsBWd8m9kipKmMNWko4J9ntnS=d-oRA@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Shawn Webb wrote: > There's no need for ROP, JOP, SROP, etc. on FreeBSD. FreeBSD is > literally stuck in 1999-era security. This is doubly true for ports, including Tor. I submitted a vuxml entry for apache-tomcat 5 days ago that still has not been committed. A follow-up resulted in two replies from a helpful member of the ports-secteam, but which took as long to write as the vulxml would have taken to validate and commit. Its CVE is priority 7 (remotely exploitable) but almost a week later pkg audit still won't tell you if you're running an exploitable Tomcat. The explanation I received is that the ports-secteam is a volunteer effort and nobody really expects 'pkg audit' to be timely anyhow. Such easily fixable problems. Even the FreeBSD Foundation for all the projects it funds, and could fund with +$2.5M in the bank, doesn't seem to care. Roger Marquis
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?nycvar.OFS.7.76.1802271107210.20686>